In this lesson,
we will learn about a Cloud Access Security broker or CASB.
A cloud access security broker is a security solution
that acts as a control point
between cloud service users and cloud applications.
Cloud access security brokers
or CASBs enforce security policies
and protect data across cloud environments.
CASB implementation concepts include API-based
and proxy-based cloud access security broker solutions.
An API-based CASB integrates directly with cloud services
and uses APIs to monitor cloud data flow,
enforce security policies,
and provide visibility into cloud usage
without affecting user experience.
Proxy-based CASBs, on the other hand,
route cloud traffic through a proxy server,
allowing real-time inspection, threat prevention,
and enforcement of security policies
by sitting between the user and the cloud device.
Let's learn more about API-based
and proxy-based cloud access security brokers.
First, we have API-based cloud access security brokers
or CASBs.
A cloud access security broker is software designed
to manage and secure access
to cloud services across various devices,
acting as an intermediary.
A cloud access security broker enforces security policies,
monitors cloud usage, detects threats, validates compliance,
and provides visibility into cloud activities,
ensuring that only authorized individuals
can access cloud services and resources.
While cloud access security brokers integrate
with identity providers to help manage authentication,
their primary role is to enforce security
and governance policies across cloud environments.
When configured as an API-based CASB,
the broker connects to cloud services through an API,
facilitating the exchange of data
between the cloud service and the user.
This implementation allows the cloud access security broker
to manage access and apply security controls directly
via the cloud provider's API.
For example, if a user's account is disabled
or their authorization is revoked,
the API-based CASB can quickly update the cloud provider,
instructing it to deny that user access to cloud resources.
Suppose a username Jason has been removed from the network
for a security violation,
the CASB or cloud access security broker
would notify the cloud provider using its API connection
to block any further logins from Jason,
even if Jason tried to access the resources
from another location.
One of the primary advantages of API-based CASBs
is that they work seamlessly with cloud-native services,
requiring no modification of user devices or traffic routes.
However, API-based cloud access security brokers also come
with certain limitations.
These brokers are dependent on the API capabilities provided
by the cloud service.
So, if the API does not support
specific granular security policies,
such as allowing access only to certain data types
or regions, the CASB may not meet the organization's needs.
Now, if your organization requires
advanced security configurations,
such as blocking specific cloud applications
or controlling data access based on geographic location
and the CSBs API lacks support for these granular policies,
the API-based approach may not suffice.
This limitation arises
because API-based cloud access security brokers rely
on capabilities exposed by the cloud service provider's API,
which might not provide the level of control needed
for complex policies like geofencing
or application-specific restrictions.
In such scenarios,
a proxy-based cloud access security broker
may be a better option.
So second,
we have proxy-based cloud access security brokers.
A proxy-based cloud access security broker
or a CASB functions by intercepting traffic
between users and cloud services.
It can be set up in two primary ways:
as a forward proxy or a reverse proxy.
In a forward proxy configuration,
the CASB is positioned at the edge of the user's network.
All traffic from users inside the network
is directed through the cloud access security broker
before it reaches the cloud service.
This allows the CASB to enforce policies
such as ensuring that the devices
and users meet security requirements
before they can access the cloud.
For example, when a parent configures a proxy
on their home network to monitor
and restrict their children's internet usage,
all traffic must pass through that forward proxy.
This allows the parent
to block access to inappropriate websites
and see how much time children spend online.
However, forward proxies have limitations.
Since all traffic is inspected,
not just the traffic heading to cloud services,
this setup can cause network bottlenecks,
reducing performance.
Additionally, users can sometimes find ways
to bypass the proxy altogether.
For instance, a tech-savvy teenager
might figure out how to connect directly to websites
by using IP addresses,
circumventing the restrictions imposed by the forward proxy.
To address some of these issues,
a reverse proxy can be used.
When protecting a cloud service as a reverse proxy,
the cloud access security broker is positioned
between the user and the cloud service,
managing and securing traffic directed
towards specific cloud applications.
And rather than inspecting all outgoing traffic from users,
the reverse proxy only intercepts
and inspects traffic headed to the cloud services.
This means that users are free to access other parts
of the internet without passing their communication
through a cloud access security broker.
But when they try to access those protected cloud resources,
the cloud access security broker steps in
to enforce security policies.
So, while reverse proxies can improve performance
by reducing unnecessary traffic inspection,
they also have a drawback.
They only work with cloud services
that support reverse proxy configurations.
So, if the cloud application does not support this method,
a reverse proxy cloud access security broker cannot be used.
So remember,
a cloud access security broker is a security solution
that manages and secures access to cloud services,
enforcing policies to protect data.
Cloud access security brokers
or CASBs come in two main formats,
API-based and proxy-based.
API-based CASBs integrate directly
with cloud services using APIs to monitor and control data
without affecting the user experience.
Proxy-based CASBs, on the other hand,
intercept traffic between users and cloud services,
inspecting it in real time to enforce security.
While API-based CSBs offer seamless integration,
proxy-based CASBs provide a little more control,
especially for complex security needs,
but the drawback is they may impact performance.